yara
Log4Shell-Automated
| yara | Log4Shell-Automated | |
|---|---|---|
| 19 | 3 | |
| 7,679 | 13 | |
| 1.8% | - | |
| 8.9 | 0.0 | |
| 6 days ago | over 2 years ago | |
| C | PowerShell | |
| BSD 3-clause "New" or "Revised" License | - |
Stars - the number of stars that a project has on GitHub. Growth - month over month growth in stars.
Activity is a relative number indicating how actively a project is being developed. Recent commits have higher weight than older ones.
For example, an activity of 9.0 indicates that a project is amongst the top 10% of the most actively developed projects that we are tracking.
yara
- Ask HN: Regex on a File or Stream
-
Who does check linux distros of malware - open source
Linux has (free) tools to improve security and detect/remove malware: Lynis,Chkrootkit,Rkhunter,ClamAV,Vuls,LMD,radare2,Yara,ntopng,maltrail,Snort,Suricata...
- Release YARA v4.4.0-rc1 - lnk module
- Release YARA v4.3.0-rc1
- yara - The pattern matching swiss knife for malware researchers (and everyone else)
- Hogy lehet észrevenni, ha valaki bejár a gépedre és adatot visz ki? KRÉTA sztori spin-off
- LNK module for Yara
-
Open source tools and standards to lookup known files
Shameless plug: I wrote a small poc module to use hashlookup's bloom filter in yara (https://github.com/VirusTotal/yara). The idea is to easily discard files that are known to be safe and so to avoid launching thousands of yara rules on a file for nothing. One can also use it to keep track of some files that meet certain conditions for instance. The module can store any string in these filters so I see a lot of useful use-cases for this little thingy :)
- Yara - The pattern matching swiss knife
-
Tasked with building a malware analysis / threat hunting machine . Need feedback
YARA - https://virustotal.github.io/yara/
Log4Shell-Automated
- Let us count the ways this snippet is awful
-
Datto's Log4 Script - Automated for Automate
I have taken Datto's Log4 detection script and automated it for the use for MSPs. You can find my script here: https://github.com/Wdrussell1/Log4Shell-Automated
- Automating with PowerShell: Detecting Log4j
What are some alternatives?
Loki - Loki - Simple IOC and YARA Scanner
Get-log4j-Windows.ps1 - Identifying all log4j components across all windows servers, entire domain, can be multi domain. CVE-2021-44228
malware-ioc - Indicators of Compromises (IOC) of our various investigations
CIPP - CIPP is a M365 multitenant management solution
awesome-yara - A curated list of awesome YARA rules, tools, and people.
log4shell-tool - Log4Shell Enumeration, Mitigation and Attack Detection Tool
yarGen - yarGen is a generator for YARA rules
Suricata - Suricata is a network Intrusion Detection System, Intrusion Prevention System and Network Security Monitoring engine developed by the OISF and the Suricata community.
flare-floss - FLARE Obfuscated String Solver - Automatically extract obfuscated strings from malware.
DIE-engine - DIE engine
yara-python - The Python interface for YARA
device-flasher - Android Factory Image Flasher for Linux, macOS and Windows